What if they allow non-phone-number-verified accounts to only place calls/texts to users only where the non-verified is already in that user's contacts?

That would prevent spam. The only people who would hear from the non-verified account is people who already took the effort to place the non-verified account username in their contacts.

(I've never used Signal and I have no idea what how it works.)